Data deletion request (KVKK § 11/e)

KVKK Article 11/e gives every data subject the right to request deletion or destruction of their personal data when the purpose of processing no longer exists.

Two deletion paths

1) Self-service account deletion (recommended)

In the app:

1. Settings → Account → Delete my account
2. A 3-step wizard explains:
   • Step 1 — What gets deleted (account, snapshots, audit logs minus 10-year legal retention)
   • Step 2 — What is retained and why (TTK 10-year invoice records; KVKK § 12 consent evidence 5 years)
   • Step 3 — Confirmation (type your email + master password to confirm)
3. A grace banner appears: "Your account will be permanently deleted in 30 days. Cancel anytime in Settings → Account."
4. During grace, all backups pause; your data is read-only
5. At day 30, a background job:
   • Deletes user-facing data (snapshots, BYOS pointers, devices, preferences)
   • Erases encryption keys (rendering encrypted chunks unrecoverable)
   • Tombstones the row in the audit log
   • Confirmation email to your address

2) KVKK § 11 formal request

If you can't access the app (lost credentials, deceased user via heir, regulator inquiry):

1. Send a formal request to kvkk@pratikyedek.com or registered mail
2. Include: identity proof (TC kimlik for natural persons, vergi levhası for legal entities), specific deletion scope, contact for response
3. We respond within 30 days (KVKK § 13)
4. If approved, deletion runs immediately; you receive a signed completion certificate (Ed25519)

The 30-day grace period

The grace period exists to protect against:

• Accidental deletion clicks
• Account hijacking (an attacker triggers deletion before you notice)
• Regret after deletion (data recovery is impossible post-key-erasure)

You can cancel deletion at any point during the grace by signing in and clicking Cancel deletion in the banner.

What we cannot delete

By Turkish law, the following are retained even after deletion:

• Invoice and payment records — 10 years (VUK)
• Audit log entries — 10 years (TTK § 82) but with PII masked (only hashes remain after user deletion)
• KVKK consent records — 5 years post-deletion (KVKK § 12 burden of proof)

These minimal records do not contain raw content, only proof of obligation discharge.

Tax-advisor accounts: special handling

If you are a tax-advisor:

• Your account deletion does not delete mukellef (client) records — they remain under the responsibility of the next assigned advisor or the data subject
• A taxpayer-transfer package (audit-share) is offered before deletion
• Mukellef whose only advisor is deleting must be reassigned within 60 days (extended grace)

Verifying deletion

After completion, you can verify:

1. We send a signed completion email with Ed25519 signature
2. Use https://pratikyedek.com/tr/verify to validate the signature
3. The signed receipt is your legal evidence of deletion

See also:

• Privacy notice link
• Data residency
• Mobile account deletion